Domestic Laws and Policy
The NDI was introduced after the establishment of the NDI Governance Framework by the Bhutanese Parliament by enacting various legislative documents, the key one being the National Digital Identity Act of Bhutan (2023) (‘NDI Act of 2023’).[28] The NDI Act does not expressly define digital ID but simply states its purpose which is to create a digital economy where citizens as self-sovereign identities can access both government and private sector services.[29]
Data Protection
The Bhutan NDI has in-built-in provisions for data protection.[30] Since the NDI is based on principles of self-sovereign identity, each individual has complete control over their personal information, thereby setting a benchmark for digital privacy.[31] Furthermore, the NDI governance framework follows a stringent approach towards data collection by ensuring that any user information is neither collected nor stored.[32] The privacy policy of NDI Bhutan states that while a copy of the facial data is stored with the Ministry of Home Affairs to ensure that identity theft or duplication does not take place, no other data provided is stored on the database servers of the NDI.[33] All digital information present in the digital wallet belongs to the user and cannot be accessed in any form (encrypted or otherwise) by the NDI Admin or a third party, unless the user consents to storing it on the NDI application’s cloud servers.[34] This information is only accessible in an encrypted format and cannot be read by the NID Admin or other third parties.[35]
The privacy provisions ensure that the data collected at the time of registration is stored and safely secured, creating accountability on those involved in the process.[36] There is no evidence to establish the usage of this data by the government against stateless persons, refugees or migrant populations since many of them would have been unable to register for the NDI in the first place since they cannot validly prove their citizenship.
International Commitments
Bhutan has not ratified any specific treaty or legislation in relation to digital ID. As a party to the CRC, Bhutan has obligations to ensure the right to be registered immediately at birth and the right to an identity.[37] Bhutan’s CRVS system procedures do not align with these obligations as only citizens and SR card holders can register births, leaving non-citizens without access to the SR card and stateless people unable to register births.[38] Stateless people are also unable to access a legal identity in Bhutan, further contradicting Bhutan’s obligations under the CRC.[39]
